SuperFetch DB files

The SuperFetch DB files can be stored in uncompressed or compressed form, where different version of Windows use different compressed forms:

Compressed SuperFetch DB - MEMO file format; Windows Vista

Compressed SuperFetch DB - MEM0 file format; Windows 7

Compressed SuperFetch DB - MAM file format; Windows 8

Compressed SuperFetch DB - MEMO file format

The MEM file consists of:

file header

compressed blocks

This format uses the LZNT1 compression method

File header

The file header is 84 bytes of size and consists of:

Offset

Size

Value

Description

0

4

"MEMO" (0x4d, 0x45, 0x4d, 0x4f)

Signature

4

4

Uncompressed (total) data size

Compressed blocks

The compressed block size is the chunk data size, which is part of the LZNT1 compressed data, + 2 bytes for the size of the chunk header itself.

The uncompressed block size is 4096 (0x1000) or the remaining uncompressed data size for the last block.

Compressed SuperFetch DB - MEM0 file format

The MEM file consists of:

file header

compressed blocks

This format uses the LZXPRESS Huffman compression method

File header

The file header is 8 bytes of size and consists of:

Offset

Size

Value

Description

0

4

"MEM0" (0x4d, 0x45, 0x4d, 0x30)

Signature

4

4

Uncompressed (total) data size

Compressed blocks

The file header is followed by compressed blocks:

Offset

Size

Value

Description

0

4

Compressed data size

4

...

Compressed data

The uncompressed block size is 65536 (0x10000) or the remaining uncompressed data size for the last block.

Compressed SuperFetch DB - MAM file format

The MAM file consists of:

file header

compressed blocks

This format uses the LZXPRESS Huffman compression method.

File header

The file header is 12 bytes of size and consists of:

Offset

Size

Value

Description

0

4

"MAM\x84" (0x4d, 0x41, 0x4d, 0x84)

Signature

4

4

Uncompressed (total) data size

8

4

Unknown (checksum?)

Compressed blocks

The uncompressed block size is 65536 (0x10000) or the remaining uncompressed data size for the last block.

Note the LZExpress Huffman variant used differs from the one used in the MEM0 format. This variant can refer to uncompressed data stored in the previous compressed block. The compressed blocks are essentially a single compressed stream.

Uncompressed SuperFetch DB format

TODO

File header

TODO

Offset

Size

Value

Description

0

4

0x0000000e

Unknown (Database type or signature?)

4

4

Uncompressed (total) data size

TRX files

The Ag*.db.trx files are of the TRX file format. E.g.

AgCx_SC*.db.trx

Note that the following format specification is incomplete.

File header

The file header is variable of size and consists of:

Offset

Size

Value

Description

0

4

1

Unknown (Version?)

4

4

Unknown

8

4

File size

12

4

Maximum number of records (of the record offsets array)

16

4

Number of records

20

...

Record offsets array, where the record offset is a 32-bit integer. Unused record offset are set to 0.